Blog

New Ransomware Targets Removable And Attached Drives

There's a new and unusual ransomware strain making the rounds that you should be aware of.

Called 'AnteFrigus,' it is primarily distributed via 'malvertising' that redirects users to the RIG exploit kit.

One of the most unusual features of this strain is the fact that it specifically doesn't target the C: drive of the target computer.

Instead, it focuses exclusively on drives that are commonly associated with mapped network drives and removable hardware.

BleepingComputer was one of several organizations to discover the ransomware. They all contacted independent security researcher Vitali Kremez to reverse engineer the malware to get a peek under the hood at how it works.

Kremez discovered that this strain only targets the D:, E:, F:, G:, H:, and I: drives. It does not even attempt to encrypt any files located on the C: drive, nor does it try to do anything whatsoever with unmapped network shares.

In addition to that, the AntiFrigus ransomware is designed to skip any file with the following extensions:

Adv

Ani

Big

Bat

Bin

Cab

Cmd

Com

Cpl

Cur

Deskthemepack

Diagcap

Diagcfg

Diagpkg

Dll

Drv

Exe

Hlp

Icl

Icns

Ico

Ics

Idx

Ldf

Lnk

Mod

Mpa

Msc

Msp

Msstyles

Msu

Nls

Nomedia

Ocx

Prf

Rom

Rtp

Scr

Shs

Spl

Sys

Theme

Themepack

Wpx

Lock

Key

Hta

Msi

Pck

The facts that the ransomware studiously ignores the C: drive and the list of extensions the malware won't encrypt are curious. This all had many people scratching their heads trying to discern why the developers would build their code in this way.

Upon review, Kremez concluded that the developers are not terribly sophisticated and are, at this point, still in the experimental stages. The code is still very much a work in progress. Work in progress or not, it can be dangerous. Be sure your staff is aware of this latest threat.